What is Snowflake Secure Data Sharing and how does it work without copying data?

Secure Data Sharing lets a Snowflake account (the data provider) grant another Snowflake account (the data consumer) live read access to specific objects — without ever copying, moving, or exporting the data. The consumer's Virtual Warehouse reads directly from the provider's cloud object storage using a metadata pointer. From the consumer's perspective, the shared data appears as a regular read-only database.

The Share object is the key primitive: the provider adds objects (tables, external tables, secure views, secure materialized views, secure UDFs) to a Share, then grants the Share to one or more consumer accounts. The Share is a metadata reference — it contains zero data bytes.

Two consumer types exist:

• Full Snowflake account — an existing Snowflake customer; uses their own Virtual Warehouse to query the share. Zero extra cost to the provider for compute.
• Reader Account — a free Snowflake account created and managed by the provider for consumers who do not have their own Snowflake subscription. The provider pays for the reader account's compute.

Limitation: cross-region or cross-cloud sharing requires the provider to first replicate data to a local account in the consumer's region before sharing. Shared data cannot be further re-shared by consumers by default.